knowledge 7 January 2021 |

Brexit Trade Deal: Impact on Data Transfers

Prior to the entry into force of the Agreement at midnight CET on 31 December 2020, EU law requirements regarding transfers of personal data from the EEA to the UK from 1 January 2021 were the subject of considerable uncertainty. Many organisations were preparing for having to put standard contractual clauses or alternative measures in place to facilitate such transfers. However, the Agreement has spared organisations from this requirement for a further transition period of up to six months (the “specified period”).

During the specified period, transfers of personal data to the UK will be deemed not to involve transfers to a third country for the purposes of EU law provided that the UK does not materially alter its data protection law regime during this period.¹ As a result, personal data can temporarily continue to be freely transferred from the EEA to UK-based data importers, without any requirement to implement additional safeguards that would otherwise be mandated by Chapter V of the GDPR.

The specified period ends on the earlier of:

1. the date on which adequacy decisions in relation to the UK are adopted by the Commission;² or
2. the expiration of the specified period, which is initially scheduled to expire on 30 April 2021 but which will be extended to 30 June 2021 unless either party objects.

It is hoped, though not guaranteed, that within the specified period, the Commission will issue an adequacy decision (or decisions) in respect of the UK. In order to do so the Commission will need to be satisfied that the UK ensures an adequate level of protection for personal data, taking into account the requirements of Article 46 of the GDPR and relevant CJEU jurisprudence.

The Agreement specifically states, however, that the UK must not (i) amend its data protection regime in place as at 31 December 2020 (other than amendments giving effect to EU law updates); or (ii) exercise certain ‘designated powers’ under the UK Data Protection Act 2018, without the agreement of the EU-UK Partnership Council. Such action would bring the specified period to an end.

If the specified period ends and no adequacy decision is reached, transfers of personal data to the UK will thereafter need to be conducted in accordance with the requirements of Chapter V of the GDPR. Controllers will have to consider alternative data transfer mechanisms, including standard contractual clauses (“SCCs”), taking into account recent developments in this regard including the Schrems II case, the EDPB’s Recommendations relating to the application of the Schrems II case and the proposed new SCCs recently published by the Commission.

While the interim solution provided for in the Agreement gives some certainty regarding personal data transfers to the UK for now, developments in Q1 and Q2 will be monitored closely.

Also contributed by Claire Bulman.